In return I assert a well deserved facepalm when I see a friend log in on his e-mail account with a variation of "Password1".
Just use a strong password ( https://xkcd.com/936/ )
The funny thing with having email as a username is, how sometimes people can use social engineering to gain control of your account, non of that fancy "hoaxer" stuff are needed when your service providers put untrained people in charge of your accounts. Hacking human stupidity is a more effective way in to get in to a secure system.
( as an example, this was on reddit just yesterday https://www.youtube.com/watch?v=lc7scxvKQOo )
Also worth mentioning my e-mails are not hosted on gmail or any big cloud player. I actually pay for my imap, when you don't pay you probably in some way are the product...
Paranoid? Maybe
Safe? More than others